{"id":137738,"date":"2025-06-21T11:12:23","date_gmt":"2025-06-21T09:12:23","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-x-org-server-21-1-18-s-ustraneniem-6-uyazvimostej"},"modified":"2025-06-21T11:12:23","modified_gmt":"2025-06-21T09:12:23","slug":"obnovlenie-x-org-server-21-1-18-s-ustraneniem-6-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/obnovlenie-x-org-server-21-1-18-s-ustraneniem-6-uyazvimostej","title":{"rendered":"X.Org Server 21.1.18 update addressing 6 vulnerabilities","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Correction releases for X.Org Server 21.1.17 and the DDX component (Device-Dependent X) xwayland 24.1.7 have been published, enabling the launch of X.Org Server for running X11 applications in Wayland-based environments. The new version of X.Org Server fixes 6 vulnerabilities. These issues may potentially be exploited for privilege escalation in systems where the X server runs with root privileges, as well as for remote code execution in configurations where access uses X11 session forwarding via SSH. <\/p>\n
Identified vulnerabilities: <\/p>\n
\n
CVE-2025-49176 \u2014 integer overflow leading to memory corruption in the implementation of the Big Requests extension, allowing requests exceeding 64 kilobytes. The vulnerability is present since the release of X11R6.0 (1994).\n
CVE-2025-49179 \u2014 integer overflow leading to memory corruption in the implementation of the X Record extension, occurring when sending excessively large values for the number of clients or ranges. The vulnerability is present since the release of X11R6.1 (1996).\n
CVE-2025-49180 \u2014 integer overflow leading to memory corruption in the implementation of the RandR extension. The vulnerability is present since the release of 1.13 RC1 (2012).\n
CVE-2025-49178 \u2014 the possibility of creating a situation that leads to blocking requests from other clients. The vulnerability is present since the release of Xorg 1.10.0.\n
CVE-2025-49175 \u2014 reading from memory beyond the buffer boundary in the X Rendering extension, occurring during operations with animated cursors. The vulnerability is present since the release of XFree86 4.3.0 (2003).\n
CVE-2025-49177 \u2014 data leak in the implementation of the XFIXES extension, caused by the lack of request size verification in the XFixesSetClientDisconnectMode handler (the client can send a shorter request and read data from a previous request). The vulnerability is present since the release of Xorg Server 21.1 RC1 (2021). <\/ul>\n